Secrets encryption

At startup, Portway encrypts plaintext secrets in environments/*/settings.json and saves the encrypted values back to the file. Encrypted values start with PWENC: and use RSA 2048 with AES.

Encrypted values ​

{
  "ConnectionString": "PWENC:aG5kc2...::dG9rZW4=",
  "Headers": {
    "ApiToken": "PWENC:bXlzZW...::c2VjcmV0"
  }
}

A connection string that is not in key-value format (e.g. postgresql://...) is not encrypted, and the error Invalid connection string format in environment '{Env}' - skipping encryption. is logged.

Keys ​

The key pair is generated on the first start. PORTWAY_ENCRYPTION_KEY is read from, in order:

1. Machine environment variable (Windows)
2. Process environment variable
3. .env in the working directory

Outside Development, Portway refuses to start without PORTWAY_ENCRYPTION_KEY.

[System.Environment]::SetEnvironmentVariable('PORTWAY_ENCRYPTION_KEY', 'your-secure-key', 'Machine')

export PORTWAY_ENCRYPTION_KEY=your-secure-key
# or in .env in the working directory:
# PORTWAY_ENCRYPTION_KEY=your-secure-key

Key replacement ​

1. Replace every PWENC: value in environments/*/settings.json with its plaintext value.
2. Stop Portway and delete .core.
3. Set the new PORTWAY_ENCRYPTION_KEY.
4. Start Portway; new keys are generated and the values are encrypted again.

Changing PORTWAY_ENCRYPTION_KEY without these steps leaves the private key unreadable: Failed to load or decrypt private key from .core/recovery.binlz4.

Troubleshooting ​

Encryption details are logged at Debug (Logging).

Related topics ​

• Environment Settings
• Security